#23386 [NEW]: 2 Crypt() with different 'salt' - matched!

From: tea at teaconcepts dot net Operating system: Windows and Unix PHP version: 4.3.1 PHP Bug Type: *Encryption and hash functions Bug description: 2 Crypt() with different 'salt' - matched! I was comparing results from 2 crypt() functions with slightly different arguments.. Both of them returned the same results: 1)Here's the script: <? //for the record $code1= crypt('peanut','butter'); //for user input $code2= crypt($a,$b); //display echo "code1: $code1 <br>code2: $code2"; if ($code1 == $code2){ echo "<br>OK"; } ?> 2)Here's the link to the script on my server: //this should result to a match http://teaconcepts.net/test.php?a=peanut&b=butter //this shouldnt result to a match, but did http://teaconcepts.net/test.php?a=peanut&b=butterasdasdaa (or whatever you add after "butter") 3)Here's my php info http://teaconcepts.net/info.php Hope this helps the PHP community! Sincerely Tea J -- Edit bug report at http://bugs.php.net/?id=23386&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23386&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23386&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23386&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23386&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23386&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23386&r=support Expected behavior: http://bugs.php.net/fix.php?id=23386&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23386&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23386&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23386&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23386&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23386&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23386&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23386&r=gnused